CVE-2025-9081
IDOR in board file download allows any user to download any file by UUID
Résumé
IDOR in board file download allows any user to download any file by UUID
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com